Penetration Testing and Network Defense

Chapter 5. Performing Host Reconnaissance

Take advantage of the enemy’s unreadiness,

make your way by unexpected routes,

and attack unguarded spots.

—Sun Tzu

The Duke of Wellington, who fought Napoleon at Waterloo, once said, “The most difficult part of warfare was seeing what was on the other side of the hill.” Wellington realized that success at war meant more than combat; it also involved secrecy and reconnaissance.

Malicious hackers also value reconnaissance as the first step in an effective attack. For them, seeing what is on the “other side of the hill” is crucial to knowing what type of attack to launch. Launching attacks pertaining to UNIX vulnerabilities if the target is running only Microsoft servers makes no sense. A little time spent ...